CVE-2025-71400 better-auth CVE debrief

Who should care

Users and administrators of better-auth passkey versions before 1.4.0 should be aware of this vulnerability and take necessary actions to secure their installations. This includes reviewing the official CVE record, assessing their deployments for potential vulnerabilities, and applying patches or updates to better-auth passkey to version 1.4.0 or later. Additionally, defenders should monitor and restrict access to the passkey deletion endpoint and implement additional authentication and authorization checks for passkey deletion to prevent unauthorized access or service disruption. Security teams and vulnerability management teams should prioritize this vulnerability and coordinate with operators and platform administrators to ensure timely remediation and minimize potential impact on operations and services.

Technical summary

The better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint. This allows authenticated users to delete arbitrary passkeys by ID, potentially leading to unauthorized access or service disruption. The vulnerability affects better-auth passkey installations prior to version 1.4.0, and defenders should focus on securing these installations to prevent exploitation.

Defensive priority

Authenticated users with valid sessions can exploit this vulnerability to delete arbitrary passkeys by ID, which could lead to unauthorized access or disruption of service.

Recommended defensive actions

• Inventory and verify installed versions of better-auth passkey to identify potential vulnerabilities.
• Apply patches or updates to better-auth passkey to version 1.4.0 or later.
• Monitor and restrict access to the passkey deletion endpoint.
• Implement additional authentication and authorization checks for passkey deletion.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2025-71400 record indicates that better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint. However, details about the vendor, product, and affected versions are not provided in the source corpus. To verify, defenders should review the official CVE record and assess their installations for potential vulnerabilities. Given the limited source detail, defenders must exercise caution and consider the possibility of broader impact across various deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.